You Didn’t Get Phished — You Onboarded the Attacker

The Hacker News argues that attackers can infiltrate organisations not through phishing, but by onboarding a malicious insider who looks like a legitimate hire. In the piece, a fictitious “Jordan from Colorado” is hired, logs in on day one, and is given access to emails, repositories, project folders, and even copied dev keys within hours.

A week in, the newcomer helps close tickets faster and provides insights into misconfigurations and rubber-stamped approvals, until it’s revealed that Jordan was an adversary who entered with a gilded welcome. The article highlights a recent surge in hiring fraud, noting a report published in August this year that found over 320 cases of North Korean operatives infiltrating companies by posing as remote IT workers with false identities and polished résumés, with a 220% year‑over‑year increase.

It argues that the threat has shifted from phishing to legitimate-appearing HR paperwork, and emphasizes that identity is now the new perimeter. The piece concludes by urging security teams to adopt strategies such as zero standing privileges to ensure access is strictly limited, time-bound, and auditable.